Skype Community - Mail Encoding Web Vulnerability #2
MICROSOFT SECURITY RESPONSE CENTER (MSRC) ID: 13022 & 13034
Vulnerability Laboratory ID (VL-ID):
Common Vulnerability Scoring System:
Product & Service Introduction:
Skype is a proprietary voice-over-Internet Protocol service and software application originally created in 2003 by Swedish entrepreneur
Niklas Zennström and his Danish partner Janus Friis. It has been owned by Microsoft since 2011. The service allows users to communicate
with peers by voice, video, and instant messaging over the Internet. Phone calls may be placed to recipients on the traditional telephone
networks. Calls to other users within the Skype service are free of charge, while calls to landline telephones and mobile phones are charged
via a debit-based user account system. Skype has also become popular for its additional features, including file transfer, and videoconferencing.
Competitors include SIP and H.323-based services, such as Linphone, as well as the Google Talk service, Mumble and Hall.com.
Skype has 663 million registered users as of September 2011. The network is operated by Microsoft, which has its Skype division headquarters
in Luxembourg. Most of the development team and 44% of the overall employees of the division are situated in Tallinn and Tartu, Estonia.
Unlike most other VoIP services, Skype is a hybrid peer-to-peer and client–server system. It makes use of background processing on computers
running Skype software. Skype`s original proposed name (Sky Peer-to-Peer) reflects this fact. Some network administrators have banned Skype
on corporate, government, home, and education networks, citing reasons such as inappropriate usage of resources, excessive bandwidth usage,
and security concerns.
(Copy of the Vendor Homepage: http://en.wikipedia.org/wiki/Skype)
Abstract Advisory Information:
The Vulnerability Laboratory Research Team discovered a filter & mail encoding vulnerability in the official Skype Community Website Application.
Vulnerability Disclosure Timeline:
2012-10-08: Researcher Notification & Coordination
2012-10-10: Vendor Notification
2012-10-12: Vendor Response/Feedback
2012-11-18: Vendor Fix/Patch
2012-11-21: Public or Non-Public Disclosure
Product: Skype Community - Lithium Forums 2012 Q3
Technical Details & Description:
A persistent input validation vulnerability is detected in the official Skype Community Website Application.
The vulnerability is located in the update post form with the unsanitized username in send mails.
Attackers can inject malicious persistent script code on application-side of the skype skype community.
The vulnerability is located in the filter function of the username when skype community is processing
to send a not parsed update mail. Remote attacker with low privileged application user accounts can change
the username values to malicious persistent script code via POST. The result in a persistent script code
inject via firstname.lastname@example.org. Successful exploitation of the vulnerability result in persistent phishing
attacks, persistent session hijacking or mail context manipulation via persistent inject.
[+] Skype Community - (Forums)
[+] Notification Mail
[+] Update Mail - Filter / Output Listing
Proof of Concept (PoC):
The vulnerability can be exploited by remote attackers with low privileged application user account and with
low or medium required user inter action. For demonstration or reproduce ...
Skype Support Network Subscription: 1 Update: Betreff: Skype is Hacked ! Win32.Trojan.Agent.Gen
schleicht sich durch die Accounts
Skype Support Network Subscription: 1 Update: Betreff: Skype is Hacked ! Win32.Trojan.Agent.Gen schleicht sich
durch die Accounts
Von: Community Mailer
Skype Support Network Subscription: 1 Update: Betreff: Skype is Hacked !
Win32.Trojan.Agent.Gen schleicht sich durch die Accounts
Hello <[[PERSISTENT INJECTED SCRIPT CODE AS USERNAME!]]>,
You have 1 update for your Skype Support Network Subscriptions.